756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33

Analysis

max time kernel
162s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
Size

1.3MB
MD5

7fe357e725d64be464acb5b055c28116
SHA1

e2041978d4e04bcccacc54a5e08562df8078bd48
SHA256

756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33
SHA512

fb04d2c509741d65a75c43e49516e06346939c01c0f0a92a78e5326f75aeeef5dcc1f332a442d878802826fdd47f8e9f2cd902576bc02a14811d1f603a7f8e5d
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakD:TrKo4ZwCOnYjVmJPa4

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe

description	pid	process	target process
PID 2976 set thread context of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe

pid	process
1796	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
1796	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
1796	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
1796	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
1796	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe

description	pid	process	target process
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
PID 2976 wrote to memory of 1796	2976	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe	756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe

C:\Users\Admin\AppData\Local\Temp\756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
"C:\Users\Admin\AppData\Local\Temp\756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\756c37007f0b26f047979fc687b29f8da95796570a7d7fbec4218d04e8ea1c33.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-132-0x0000000000000000-mapping.dmp

Download
memory/1796-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1796-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1796-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1796-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1796-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1796-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download